"Love is our Resistance…"

I wish I could hire Will Smith to sing all about how my brain got flip-turned upside-down by Paypal‘s baffling approach to fraudulent accounts, but alas, I am just one woman.

Paypal, however, is a company with nearly 20 years of experience, development and presumably, a team dedicated to the prevention of fraudulent activity, including money laundering. After all, the company’s revenues of $6.6 Billion (2013 figure) should be worth protecting.

That said, it would seem that one of Paypal’s draws — that it’s easy for anyone with an email address to create an account — is one of its massive problems.

I currently run a music blog, Open ‘Til Midnight – a little operation I helm that is devoted to reviewing and promoting music, primarily indie artists and Canadian content. I love what I do, but the sheer volume of emails involved is but one reason why I created a unique account for the website. That address (otmblog at gmail dot com) is presented on our submissions page and ultimately, it’s not that hard to scrape up.

On October 21st, 2014, imagine my annoyance and surprise to find a welcome email for “Alexandra Macon” to Paypal, in my inbox. Now, last I checked, I am not the Managing Editor of Vogue magazine. I also have been a Paypal customer under my personal email address for nearly 15 years.

Now, here’s where things get interesting: I then received a phishing email “from Paypal” within hours of this sign-up that falsely employed my email account:

Clearly bullshit. I also received another “getting started” email from Paypal legitimately.

Now, I work in fraud for a financial institution for my day job. What better way, I mused, to push a phishing email through spam filters and make it seem legitimate than to sign up for a Paypal account first, thereby sandwiching the phishing between two valid layers?

In any case, I clearly did not apply for a Paypal account and wanted my email removed from their system. I also wanted to prevent anyone from making fraudulent transfers associated with my email (which is, ostensibly, my business account). I went to Paypal‘s website and looked to report the account as fraud.

Problem #1: I could find no other way to report this theft of my intellectual property than to sign in with my Paypal account to get a unique “verifying code”. There was no easily accessible phone number. I logged in with my separate personal account, got the code and phone number, and phoned in to Paypal.

Problem #2: Despite my clearly being verified as a customer (through the above process), the first representative confirmed that yes, someone had used my blog email account and set up Paypal, but she could not deactivate the account in any way. She then went on to challenge me on whether or not I owned the email address, refused to email it so I could sit on the phone and confirm it, and then said this was a “Google issue”. Her excuses for the behaviour of this fraudster were “a typo” (otmblog? REALLY?) or “a recycled email address”.

In fact, this “recycled email address” business was a very popular party line throughout my hour talking with three different employees, including a security manager. As in, someone who should really know security, right? Hmm. See, no one could answer my counter to that (“Why would you sign up with an email address you cancelled years ago, when Paypal requires email verification to receive funds?”). Second, the word blog is a fairly recent addition to common vernacular. Third, I’ve held the account for years. And fourth: Google does not recycle usernames — not even to the person who deleted it.From their own TOS:

Note: Deleting your address won’t free up your username. Once you delete your Gmail address, you won’t be able to use that same username (username@gmail.com) in the future.

Clearly not having any clue once I dropped the words “fraud” and “phishing”, I was passed to someone in the Security department.

Problem #3: I was then informed that the account created with my email address, without consent, had been “limited” so it could not do any transactions without email verification. However, my email would remain on the account forever. I immediately questioned the logic of this, and was fed a series of nonsense reasons at first: that maybe someone made an honest typo; maybe the address had been recycled; that it would somehow be wrong to delete the account of someone sharing the name of a famous person just because I said so.

Repeatedly, I indicated that they could email me right on the spot and confirm that the person on the phone was the rightful owner of the account. I was denied, over and over. As someone who works in fraud, I was scoffed at for pointing out that the phishing email proved that no good intentions could be held by the account creator (“Why would someone create an account to then send a phishing email?” the rep asked condescendingly). Any account can send without email verification — which makes no sense — but somehow, that makes money laundering impossible, so hey, why require verification before an account can do anything? I explained money laundering to Paypal‘s security rep. It was embarrassing.

I became increasingly irate that my email would not be removed from the account. It is mine, it is associated with my brand, and it belongs to me. Finally, the rep relented with all other nonsensical explanations and revealed the truth.

Problem #4: Apparently, the only way Paypal has figured out to track fraudulent information is to preserve these accounts forever, in a limited state. My email would forever be associated with a fake name, likely fake address etc. for the sake of ensuring that specific constellation of information would never be used again.

Problem #5: I can never use my valid email, associated with my brand, to open a brand-related Paypal account. My brand is now tainted with a fraud label in a server somewhere.

I argued against the foolishness of this being the company’s only strategy. I pointed out that fraudulent credit applications occur in banks all the time, but were the real Jane Smith to apply for a Visa, we wouldn’t ban her from our bank, because that would be turning away customers — in effect, what Paypal is doing with this policy. “We don’t do credit,” was the reply. “Ditto bank accounts for us,” I countered, “Which is equivalent to what you do.”

I’m escalated to a self-described Security Manager named Dan, who confirms all the nonsense above. I’m increasingly incredulous.

“What if someone signed up with the customer service account of Boston Pizza, or its owner Jim Treliving?” I continued. “Would their email be stuck forever in your fraud database?” I was told yes, yes it was. Huge loophole: fraudsters could create Paypal accounts for every member of a major company with minimal effort. Ludicrous.

“Okay, so you need to keep the profile to run it against future profiles,” I concede. “Fine then: why not have a generic email like ‘fraudaccounts@paypal.com’ that you could sub in so innocent people like me could have their damn accounts back?” The response: “That’s not a bad idea and I can send it along, but you cannot remove your email from this account.”

“Fine then. Can I reset the password on it, since that will go to my email address, and then change it all up and delete it?” Nope, I’m told, because I did the right thing and reported it. It’s Limited so I can’t do anything to it.

After wasting an hour of my life, I hang up at midnight my local time and am utterly shocked by the lack of common sense, security protocols, anti-money laundering practices and general customer service Paypal exemplifies.

So, to recap:

Some fraudster or jerk signs you up for Paypal. Maybe you would have wanted to use the service someday, maybe not. Either way, too bad: it’s theirs, despite the fraudster never having to verify the legitimacy of their email account. Jesus, I needed to jump more hoops to join a radio station mailing list than Paypal requires.

Despite this lack of legitimacy, a fraudster can send illegally obtained funds from their Visa (or a stolen Visa, perhaps, as I see all day long at work) to another Paypal account, which can lead to a laundering chain.

The only way Paypal, a major company with billions and offices in Silicone Valley, can figure out to track fraud, is to brand emails with a broad brush and maintain thousands of fake accounts forever.

There have been plenty of critics of Paypal’s shoddy practices, particularly those involving seller protections, but this really takes the cake. And I’m not the only one: Google results will take you to community threads with others sharing the experience of an email account being stolen. Identity theft is just par for the course, it seems. No big deal.

This is a business that asks you to connect your credit card and personal banking information to your account. I’m not so sure I feel comfortable using their services anymore.

Have a similar experience with Paypal? I’d love to hear it. Please leave a comment below.

Major hat tips to @zuzuhaha for starting the gears grinding (and no thanks for making me listen to the original to verify timing as best as possible) and crucial lines, as well as @sirilyan for another amazing couplet of lines…

People of Toronto, allow me to present a song in honour of tomorrow’s appeal ruling for (hopefully soon-to-be-ex-) Mayor Rob Ford.

I am not a girly-girl. I hate dresses, skirts and heels. This isn’t to say that I’m not feminine. I love blouses and cute tops. I just tend to pair them with jeans.

I also have very problematic feet to shop for as a woman. I’m a 9 1/2 wide on one foot, just over 9 wide with the other. It’s not quite enough of a disparity to need two pairs, particularly with running shoes (my mainstay) or flip flops. But dress shoes… ugh. I have four pairs I’ve barely worn because I always end up with brutal blisters on my heels or the bottom of my feet.

In having recently acquired a new job, I am faced with the annoyance of business casual. I already brutalized my heels for the interview and am still nursing them. Since I must now find a way not to become homicidal over shoes, I thought I’d share some tips and tricks dug up around the internet.

1. The tried and true many people suggest is wearing two pairs of socks to stretch out shoes and break them in. One suggestion specifically states to wear an inside out pair, dust with talcum powder, then put on another pair as per normal on top. This will work for home stretching or shoes where you can get away with socks, but it likely won’t help with strappy heels you need to wear tomorrow.

2. Placing blister protection strips, bandaids or tape over places you expect will rub. I think most of us have gone this route. I know I did it for a long walk tonight to spare my healing feet.

3. Placing athletic tape/duct tape/something inside the shoe itself to keep it from rubbing. I’d wondered about this and am glad it’s not a foolish notion. Others have also suggested a blister block stick product – like a deodorant stick for feet and blisters.

4. Using Bodyglide or a similar product from a runner’s shop on feet prior to wearing. I’m very keen to investigate, as this especially works for bare foot in shoe situations.

5. Get enough money to order custom shoes. Ha.

What do you do to break in your shoes? How do you manage blistering? Why do women’s shoes tend to suck for comfort? Come tell me more and save me from painful hell.

This post may be triggering for survivors of sexual violence. Please be safe.

Last night, I marched with Take Back The Night, an annual event in the city where women and trans people take to the streets, make a hell of a lot of noise and reclaim the right to walk the streets without fear. This year was, from the reports of many, one of the biggest turn-outs here in Toronto. This is no surprise to me, given the recent wave of public sexual assaults concentrated in the Christie Pits vicinity. Women are angry that while the news media are actually reporting on sexual violence, nothing really seems to be happening on the policing front. I have to confess that I don’t count on police to help with sexual violence: I didn’t report my assaults after a Criminology professor I once had implied that women cry rape after leading men on, among other disgusting comments that I knew many survivors had heard from the mouths of law enforcement. Standing up in solidarity tonight was far more freeing.

I cannot recall how many times I have been sexually assaulted. I can tell you which incidents left indelible marks on my psyche. I can tell you which memories haunted my suicide attempts, which images tormented me in flashbacks and destroyed my healthy sexuality for years.

I can tell you about the man whose name I couldn’t even speak aloud after his betrayal of a longstanding friendship and former romance. I can tell you on dark nights that I look him up on Facebook, that he has two daughters I fear for. I fear, you see, because as a pre-teen, he watched a male friend violate friend’s younger sister and neither intervened nor spoke up.

I can tell you of the family that took advantage of me, of how they left me ashamed of my body. I can tell you how seeing their friend requests on, yes, Facebook struck terror in me and made me want to recoil like a child. I can tell you how they, my peers in age, were sexually interfered with by teenage girls on our block, only to take that out on me.

I can tell you of the time last year where a man sexually assaulted six women in a general admission concert crowd, that five men watched and did nothing as each woman protested and fled until I became number six. I can recall how I punched him and grabbed him by the throat even as he still tried to touch me, and how my request for help in restraining him for security was ignored by the men behind me. The women, however, helped, as did my male friend.

I can tell you of the time I was followed down a dark street past midnight and how I approached the doorstep of a lit-up townhouse and faked ringing the bell. I can still see him lingering on the sidewalk before mercifully giving up and walking away. I can tell so many stories of my own and so many of the survivors I know. I can tell you why women and trans people need to take back their right to walk – to live – without fear.

But I could also tell you of the ex-boyfriend who was repeatedly molested by male babysitters from age 10-14, and how that damage lingered. I can tell you of the male survivor friend I have and how his experiences have dramatically affected him. I could share with you how isolated he feels, how he doesn’t believe he belongs anywhere as a survivor.

I cannot disagree with his concerns, and it is here that I find myself struggling mentally and emotionally with the mandate that cisgendered men are not invited to the march portion of Take Back The Night (they are welcome to the rally and to stand on the sidewalks and support women). Women and trans people are unquestionably disproportionately affected by sexual violence. However, in that understanding of sexual assault as a crime “that happens to women”, male survivors are silenced withing a unique layer of shame. We are survivors all, but just as my male friend will never understand the experience of walking the streets as a woman, I will never truly understand survivorship as he experiences it, either.

In recent years, those of us involved in the fight for an end to sexual violence have tried to dispel that shame, that emasculation pain that rape culture thrusts down the throats of male survivors. More men are speaking out and demanding justice for themselves and that is such a good thing. In opening this space, we have given these men a voice, and with that voice, cisgendered males are asking why they cannot march with Take Back The Night, why men must stand aside or go to a workshop to be better allies. I noticed several questions along these lines.

I don’t have any answers.

The fact is, the dynamic of this discussion is changing from the year of the event’s inception. Trans men and women both participate. On a personal level, I would be comfortable walking with my male survivor friend at my side, in acknowledgement of the pain men have inflicted upon him. Then again, the fact remains that cisgendered male survivors are still safer than I am at night.

I am torn because I need the space of this march to rage against the fear and oppression I cope with as a woman. I want that space. But the friend in me sees how desperately the male survivors I know need a space – and women as allies – as they heal themselves and also combat the gender role bullshit they face in our rape culture. Maybe it’s because I have been hugely involved in the Tori Amos fandom that I am acutely aware of these silent men; her music draws them in just as much as female survivors. The why doesn’t matter. What matters is I hear their voices, too.

What is the answer? Again, I do not know. I just see the dialogue between the lines and know that we need to reach out into the ether and address it. Perhaps instead of only a workshop on allyship for men during the march, a safe space could be offered for male survivors to unify and affirm each other’s experiences. Maybe we need another annual event where all survivors of all gender identities and walks of life unite together and raise our collective voices. What I do know is isolation. I know how it feels to believe you do not belong, that you are somehow branded or tainted as ‘other’. I know shame. I don’t wish this on my brothers.

One woman noted feeling unsafe after an anti-psychiatry speaker gave their talk at this year’s rally – that the mentally ill were stripped of a safe space. Men who ask and are told no, you cannot participate even as a survivor of sexual violence perhaps feel they, too, are stripped of a safe space. Having had my safe space ripped away so many times, I just want there to be safety for all survivors. Perhaps this post will open a door to that space for men like my friend, my assailants, my ex. It need not be the space female-identified survivors claim; perhaps it should not be. But they, too, have voices. Maybe it’s time we listen for those whispers.

It’s been a brutal summer where I’m at and my two window A/C’s have been getting quite the workout – meaning extra rounds of cleaning. With the weather cooling (just a little), it’s time to remember proper storage.

Sorry guys, sometimes these tips are for the female-identified. The gorgeous drag queens I know probably possess these skills, much to my shame.

Bras are expensive. Guys always ask, “Why do women have so few bras compared to panties?” in my circle, and I’m always answering, “I can get eight pairs of panties for twelve bucks. Bras are forty EACH if you’re lucky. Enough said.” It’s disgusting. It’s highway robbery, as the saying goes. Oh sure, if you’re lucky to have smaller breasts (no bigger than a 36C), you may get to score $10 and $20 bras at sales now and then. Ironically, the bigger you are (and the more essential a bra), the worse you’re pillaged. No one makes cheap bras for a 40DD (trust me, I know). You’re stuck going to Victoria’s Secret, where it’s a miracle if they even STOCK a DD of any band size. No, somehow you’re expected to order them by mail, pay shipping charges too, and guess what? You might hate the fit, or the look, because strangely, I’ve found that the bigger my cup size gets, the more bras seem to want to flatten my cleavage.

Enough ranting: you came here to clean a bra. Because the things are so damn expensive and fragile, you want to keep them beautiful and make them last.

Sweat stains, deodorant stains, red wine on the white bra – you name it, it happens. There’s a reason I prefer black bras. Minimal issues. However, lighter tops require lighter bras, alas. Recently, I had a bra that I just could NOT get a stain out of. I’d worn it to an outdoor music fest in the summer’s boiling heat. Enough said.